Blind quantum computation for Alice who does only measurements 
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Blind quantum computation is a secure quantum computing protocol which enables Alice who 
does not have sufficient quantum technology to ask Bob to perform quantum computation on Bob's 
fully-fledged quantum computer in such a way that Bob cannot learn anything about Ahce's input, 
output, and algorithm. In previous proposals, Alice needs to have a device which generates quan- 
tum states, such as single-photon states. Here we show that Alice who does only measurements, 
such Eis the polarization measurements with a threshold detector, can perform the blind quantum 
computation. In several experimental setups, such as optical systems, the measurement of a state 
is much easier than the generation of a single-qubit state. Therefore our protocols can ease Alice's 
burden. Furthermore, the security of our protocols is device independent in the sense that Alice 
does not need to trust her measurement device. Finally, the security of our protocols is based on 
the no-signaling principle, which is more fundamental than quantum physics. 



Introduction. — Our future quantum computing will be 
in the style of the "cloud quantum computing" , since 
only limited number of groups, such as governments and 
huge industries, will be able to possess scalable quan- 
tum computers. How can a server of the cloud quan- 
tum computing assure the security of a client's privacy 
in the cloud quantum computing? The concept of the 
blind quantum computation [l|-|8| provides the solution. 
Blind quantum computation is a secure quantum com- 
puting protocol which enables a client (Alice) who has 
only a classical computer or a primitive quantum device 
which is not sufficient for universal quantum computa- 
tion to ask a server (Bob) to perform her quantum al- 
gorithm on his fully-fledged quantum computer without 
leaking any Alice's privacy (i.e., which algorithm Alice 
wants to run, which value Alice inputs, and what is the 
output of the computation) to Bob [iMll- For classical 
computation, Feigenbaum [§| introduced the notion of 
"computing with encrypted data" , and showed that for 
some functions /, an instance x can be efficiently en- 
crypted into z — Ek{x) in such a way that Alice can 
recover f{x) efficiently from k and f{z) computed by 
Bob. Moreover Abadi, Feigenbaum and Killian showed 
that no NP-hard function can be computed blindly if 
unconditional security is required, unless the polynomial 
hierarchy collapses at the third level |10i]. Even restrict- 
ing the security condition to be only computational, the 
question of the possibility of blind computing, also known 
as fully homomorphic encryption, remained open for 30 
years 

The first example of blind quantum computation was 
proposed by Childs [H where the quantum circuit model 
was adopted, and the register state was encrypted with 
quantum one-time pad scheme [12| so that Bob who per- 
forms quantum gates learns nothing about information 
in the quantum register. In this method, however, Al- 
ice needs to have a quantum memory and the ability to 
perform the SWAP gate. The protocol proposed by Ar- 



righi and Salvail is that for the calculation of certain 
classical functions, i.e., not the universal quantum com- 
putation, and it requires Alice to prepare and measure 
multi-qubit entangled states. Furthermore, it is cheat- 
sensitive, i.e.. Bob can gain information if he does not 
mind being caught. Finally, in their protocol. Bob knows 
the unitary which Alice wants to implement. Aharonov, 
Ben-Or and Eban's protocol [4J requires a constant-sized 
quantum computer with memory. 

On the other hand, in 2009, Broadbent, Fitzsimons 
and Kashefi [3j] proposed a new blind quantum computa- 
tion protocol which uses the one-way model 13l4la|. In 
their protocol, all Alice needs are a classical computer 
and a primitive quantum device, which emits randomly 
rotated single-qubit states. In particular, Alice does not 
require any quantum memory and the protocol is uncon- 
ditionally secure. Recently, this protocol has been ex- 
perimentally demonstrated in an optical system Q . Fur- 
thermore, this innovative protocol has inspired several 
new other protocols which can enjoy robust blind quan- 
tum computation. In Ref. 0, two protocols which enable 
blind measurement-based quantum computation on the 
Afileck-Kennedy-Lieb-Tasaki (AKLT) state [H [3 have 
been proposed. In Ref. Q , a protocol of the blind topo- 
logical measurement-based quantum computation [19|- 



2l| has been proposed. Due to the topological protec- 
tion, it is fault-tolerant 3"21|. The error threshold of 
the blind topological model has been shown to be com- 

(i.e., non- blind) 
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parable to that of the original 
topological quantum computation [8|. 

Before starting the main part of this paper, let us 
quickly review the protocol of Ref. 0]. In this proto- 
col, Alice and Bob share a classical channel and a quan- 
tum channel. The protocol runs as follows: (1) Alice 
prepares randomly- rotated single-qubit states {\9j) = 
^(|0) +e'«^ |l))}f^i, where 0,€A^ {^\k = 0, 1, 7} 
is a random angle, and sends them to Bob through 
the quantum channel. (2) Bob creates a certain two- 
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dimensional graph state, which is called the brickwork 
state [3|, from by applying the CZ gates. (3) 

Alice calculates the measurement angle on her classical 
computer, and sends it to Bob through the classical chan- 
nel. (4) Bob performs the measurement in that angle, 
and returns the measurement result to Alice. They re- 
peat (3)-(4) until the computation is finished. If Bob is 
honest, Alice obtains the correct answer of her desired 
quantum computation Q. If Bob is not cooperative, the 
correctness of the final output is no longer guaranteed. 
However, it can be shown that whatever evil Bob does. 
Bob cannot learn anything about Alice's input, output, 
and algorithm (An intuitive understanding of the 
security of this protocol is as follows. Let us assume 
that Alice wants Bob to measure a particle of the graph 
state in the angle 0. If Alice directly sends (p to Bob, 
Bob knows (f>, and therefore Bob can gain some infor- 
mation about Alice's algorithm. Therefore, Alice sends 
S — (f) + 9 + rTT to Bob, where r G {0, 1} is a random num- 
ber which comes from a certain technical reason which 
we do not explain here Since the particle to be mea- 
sured is pre- rotated by 9 in the above process (1), the 
particle is effectively measured in the angle (j)-\-rTr, when 
Bob does the measurement in the angle 6. The effect of 
m is just the flip of the measurement result. In this way, 
Alice can have Bob do the measurement in the angle 
without allowing Bob to know the value of (p.) 

The motivation of the blind quantum computation is to 
enable Alice, who does not have any sophisticated tech- 
nology and deep knowledge, to perform universal quan- 
tum computation. Therefore, there are two important 
goals. One is to make Alice's device as classical as pos- 
sible, since Alice is not expected to have any expensive 
laboratory which can maintain the coherence of compli- 
cated quantum experimental setups. The other is to ex- 
empt Alice from the precise verification of her device, 
since Alice is not expected to have enough technology 
and knowledge to verify her device. Such a verification 
is important since she might buy the device from a com- 
pany which is under the control of Bob, and therefore 
the device might not work as Alice expects. For exam- 
ple, if Alice is supposed to send a single-photon to Bob, 
Alice must confirm that more than two identical photons 
are not sent to Bob, since otherwise Bob might be able to 
gain some information by using, e.g., the photon- number- 
splitting (PNS) attack [li^. In Ref. Q, a first step to 
the first goal, namely making Alice's device more classi- 
cal, was achieved. They proposed an ingenious protocol 
of the blind quantum computation in which what Alice 
needs to prepare are not single-photon states but coher- 
ent states. Since coherent states are considered to be 
more classical than single-photon states, their protocol 
allows Alice's device to be more classical. 

In this paper, we show that Alice who has only a mea- 
surement device can perform the blind quantum compu- 
tation. We propose three protocols each of which has its 



own advantages. In several experimental setups, such as 
quantum optical systems, the measurement of a state, 
e.g., the polarization measurement of photons with a 
threshold detector, is much easier than the generation of 
a single-qubit state, such as a single-photon state. There- 
fore, our results achieve the above mentioned first goal, 
namely making Alice's device more classical. As we will 
see later, our protocols can cope with the particle loss 
in the quantum channel and the measurement ineflacien- 
cies, which also means that our protocols allow Alice's 
device to be more classical. Furthermore, our protocols 
also achieve the second goal: the security of our protocols 
is "device independent" [i^ in the sense that Alice does 
not need to trust her measurement device. Finally, we 
will see that the security of our protocols is based on the 



no-signaling principle 27 [, which is more fundamental 



than quantum physics 

Protocol 1. — Our first protocol runs as follows: (1) 
Bob prepares a resource state of measurement-based 
quantum computation. Any resource state can be used 
for this purpose. For example, the two-dimensional clus- 
ter state Il3l4l5l |. the three-dimensional cluster state for 



the topological quantum computation 3"21|, the ther- 
mal equilibrium states of a nearest-neighbour two-body 
Hamiltonian with spin-2 and spin-3/2 particles [2^ or 
solely with spin-3/2 particles [29| at a finite temper- 
ature for the topological measurement-based quantum 
computation, resource states for the quantum compu- 
tational tensor network 30l-33, the one-dimensional or 
two-dimensional AKLT states 118. 33. 34 
state 



35|, and states in the Haldane phase 



the tri-cluster 
. (2) Bob 

lets Alice know which resource state he has. (3) Bob 
sends a particle of the resource state to Alice through 
the quantum channel. (4) Alice does a measurement on 
the particle. They repeat (3)- (4) until the computation 
is finished. 

Obviously, at the end of the computation, Alice obtains 
the correct answer of her desired quantum computation 
if Bob is honest, since what Alice and Bob did is nothing 
but a usual measurement-based quantum computation. 
(It is something like the following story: Alice and Bob 
are in the same laboratory. The preparation and the 
maintenance of the resource state, which are boring rou- 
tines, are done by poor Bob, whereas the most exciting 
part of the measurement-based quantum computation, 
namely the measurements and the collection of data are 
done by his boss Alice. Somehow, there is no communi- 
cation between them.) 

It is also easy to understand that whichever states 
evil Bob prepares instead of the correct resource state, 
and whichever states evil Bob sends to Alice, Bob can- 
not learn anything about Alice's information, since Alice 
does not send any signal to Bob and therefore because 
of the no-signaling principle (27l | Bob cannot gain any in- 
formation about Alice by measuring his system 37|: If 
Alice could transmit some information to Bob by measur- 
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ing her system, it contradicts to the no-signahng princi- 
ple [39,] . (Note that we assume there is no unwanted leak- 
age of information from Alice's laboratory. For example. 
Bob cannot bug Alice's laboratory. It is the standard 
assumption in the quantum key distribution (40| . ) In 
Appendix A, we give the mathematical proof of the se- 
curity of Protocol 1 based on the no-signaling principle. 

Protocol 1 has four advantages. First, no random- 
number generator is required for Alice. This is advanta- 
geous since it is not easy to generate completely random 
numbers, and the random-number generator might be 
provided by a company under the control of Bob. Second, 
the security of the protocol is "device independent" in the 
sense that Alice does not need to trust her measurement 
device, since whatever Alice does. Bob cannot gain any 
information about Alice's computation as long as there 
is no unwanted leakage of information from Alice's labo- 
ratory, which is the standard assumption in quantum key 
distribution [i^ . Third, the proof of the security is intu- 
itive and very simple, and it is based on the no-signaling 
principle |27ll . which is more fundamental than quantum 
physics [27]. (Even if quantum physics is violated in a fu- 
ture. Protocol 1 survives as long as the no-signaling prin- 
ciple holds.) Finally, any model of measurement-based 
quantum computation (such as the cluster model [13- 
the AKLTjnodels [H, llil, and the topologi- 



angle. One way of overcoming that disadvantage of Pro- 
tocol 1 is to use a model which can cope with the par- 
ticle loss. For example, it was shown in Ref. [4l| that 



cal model 3-21|, etc.) can be directly changed into a 
blind model: Bob has only to let Alice do measurements. 
(On the other hand, in Ref. many complicated pro- 
cedures are required to make the AKLT measurement- 
based quantum computation blind.) Since no modifica- 
tion is required to make a model blind, the advantage of a 
model is preserved when it is changed into a blind model. 
For example, an advantage of doing the measurement- 
based quantum computation on the AKLT states is that 
the quantum computation is protected by the energy gap 
of a physically natural Hamiltonian 18 , 33 , [13] ■ If the 
AKLT model is used in Protocol 1, Bob who prepares 
and maintains the resource AKLT state can enjoy that 
advantage, i.e., Bob's state is protected by the en ergy 

Mm- 



gap. This is also the case for the models of Refs. 
If these models are used in Protocol 1, Bob can enjoy 
the advantage of these models, i.e., Bob does not need to 
keep his state in the ground state; His state is allowed to 
be the equilibrium state at a finite temperature. 

A disadvantage of Protocol 1 is that the quantum 
channel between Alice and Bob must not be too lossy. 
(Throughout this paper, "the channel loss" includes the 
detection inefficiency of Alice's device, since the detec- 
tion inefficiency behaves like the channel loss.) On the 
other hand, in the previous protocols 0, 0, 0, 01 where 
Alice sends randomly rotated particles to Bob, the high 
loss rate of the quantum channel is not crucial, since if 
Bob docs not receive a particle due to the loss in the 
quantum channel, Bob has only to ask Alice to again 
generate and send another state with another random 



the t opolog ical measurement-based quantum computa- 
tion 1§-21| can cope with the heralded particle loss if 
the loss probability is below the threshold. If Bob uses 
this model, Alice and Bob can perform Protocol 1 with- 
out suffering from the particle loss as long as the loss rate 
of the quantum channel between Alice and Bob (and that 
of Alice's device) is below the loss threshold calculated 
in Ref. 141|]. 

Protocol 2. — If the channel loss rate is too high, we 
can use the following protocol. Protocol 2, which runs as 
follows: (1) Bob creates the Beh pair ^(|00) -f |11)) and 
sends a half of it to Alice through the quantum chan- 
nel. By using the classical channel. Bob lets Alice know 
that he sent the particle. (2) If Alice does not receive 
the particle, because of the channel loss, Alice asks Bob 
to try again, and goes back to (1). (3) If Alice receives 
the particle, she generates a random number Q ^ A, and 
measures the particle in the basis { -i^ ( 1 0) ± e"*^ 1 1) ) } . Af- 
ter Alice's measurement, Bob's state is, from Alice's view 
point, \d) = -^(|0) -|-e*^|l)) if her measurement result is 

m = 0, and |6' + 7r) = :^(|0) — e*^|l)) if her measurement 
result is m = 1. However, from Bob's view point, it is 
the completely-mixed state \l, since Bob does not know 
Alice's measurement result. (4) They repeat (l)-(3) until 
Bob has TV particles. (5) From these iV particles. Bob cre- 
ates the brickwork state [3| or the three-dimensional clus- 
ter state for the topological measurement-based quantum 
computation [19,--21]. For the former, the blind protocol 
of Ref. jSl is used, and for the latter, the blind protocol 
of Ref. [8| is used. 

Obviously, if Bob is honest, the correct blind quantum 
computation is possible. On the other hand, if evil Bob 
prepares some another state instead of the Bell pair, and 
sends some of them to Alice, the correct quantum com- 
putation is no longer guaranteed. However, we can show 
that whichever states evil Bob prepares, and whichever 
states evil Bob sends to Alice, Bob cannot gain any infor- 
mation about Alice's input, output, and algorithm fi^. 
A proof of the security of Protocol 2 is given in Appendix 
B. Note that, unlike Protocol 1, Protocol 2 does not re- 
quire a quantum channel with low loss rate, since if the 
half of a Bell pair is lost in the channel, Alice has only 
to ask Bob to generate a Bell pair and to send a half 
of the Bell pair again. There are three disadvantages in 
Protocol 2. First, Protocol 2 can be used only for some 
class of models of measurement-based quantum compu- 
tation, such as the two-dimensional cluster model l^- 13 
and the topological model [ii-ilj, where the entangling 
operations which create the resource state commute with 
the random prerotation of each particle. Second, Alice 
needs a random number generator. Third, the proof of 
the security is no longer based on the no-signaling prin- 
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ciple, since Alice sends classical messages S to Bob 0, [1] . 

Protocol 3. — Surprisingly, we can modify Protocol 2 
in such a way that Alice does not need any random num- 
ber generator and that the security is based on the no- 
signaling principle. How can we do that? First, in or- 
der to respect the no-signaling principle, Alice cannot 
send any classical message which is related to her algo- 
rithm. Therefore, Alice must measure the half of the 
Bell pair in a specific (not random) angle which is re- 
lated to her algorithm. Second, Bob's measurements 
must be done always in the same angle, since otherwise 
Bob can gain some information about Alice's computa- 
tional angles. It is exciting to notice that we have a 
similar situation in a completely different field, namely, 
the fault-tolerant quantum computation on the one-way 
model [i^. There, only Pauli-basis measurements are 
allowed since the Calderbank-Shor-Steane (CSS) codes 
support transversal measurements only for the Pauli ba- 
sis [471, |48|. In order to perform non-Clifford gates, the 
magic states are injected. These facts suggest that 
if (1) Bob sends a half of a Bell pair to Alice, (2) Alice 
measures the half of the Bell pair in a specific angle, and 
(3) after Alice's measurement Bob injects his half of the 
Bell pair into his resource state, then universal quantum 
computation could be possible even if Bob does the mea- 
surements in a fixed basis. In fact, we can do that in 
Protocol 3, which runs as follows: (1) Bob creates the 
BeU pair ^(|00) + |11)) and sends a half of it to Al- 
ice through the quantum channel. By using the classical 
channel. Bob lets Alice know that he sent the particle. 

(2) If Alice does not receive the particle due to the chan- 
nel loss, Ahce asks Bob to try again, and goes back to (1). 

(3) If Alice receives the particle, she measures it in the 
basis {-^(|0)±e~'^|l))}, where is a certain angle (not a 
random angle) determined by the algorithm which Alice 
wants to run. {0 = 0, 7r/2 for a Clifford gate, and 9 ~ tt/A 
for a non-Clifford gate. For details, see Appendix C.) (4) 
Bob couples the half of the Bell pair which he has to his 
state by using the GZ gate, and does the measurement 
in the {|+),|— )} basis. (For details, see Appendix C.) 
(5) Bob returns the measurement result to Alice through 
the classical channel. (6) They repeat (l)-(5) until the 



computation is finished. As is shown in Appendix C, 
if Bob is honest Alice can obtain the correct answer of 
her desired quantum computation by appropriately tak- 
ing 0's. Also, in Appendix D, it is shown that whichever 
states evil Bob prepares and whichever states evil Bob 
sends to Alice, Bob cannot learn anything about Alice's 
information. Intuitive understanding of the security of 
Protocol 3 is as follows. In Protocol 3, Alice sometimes 
sends the message "I did not receive the particle. So send 
it again." to Bob through the classical channel. Because 
of this fact, one might think that the no-signaling as- 
sumption can no longer be applied. However, we can still 
consider that the situation is "effectively no-signaling" , 
since what Alice sends to Bob is obviously nothing to do 
with Alice's input, output, and algorithm, and therefore 
effectively, there is no signal transmission from Alice to 
Bob. In other words, there is no meaningful signal trans- 
mission from Alice to Bob. Therefore, it is reasonable 
that in such an "effectively no-signaling" situation. Bob 
cannot gain any information about Alice's computation 
by measuring his system. 

Discussion. — In this paper, we have proposed three 
protocols of blind measurement-based quantum compu- 
tation for Alice who can do only measurements, such as 
the polarization measurement with a threshold detector. 
In quantum optics, for example, the state measurement 
is much easier than the single-qubit state generation. 
Therefore our scheme makes Alice more classical than 
the previous protocols [1, H, Q in certain experimental se- 
tups, such as optical systems. In the protocol of Ref. 0, 
Bob is required to perform the non-demolition photon- 
number measurement, which is not easy with the current 
technology. In our protocols, on the other hand. Bob is 
not required to have such an additional high technology. 
Finally, there is a way of detecting evil Bob: Alice can 
randomly choose some subsystem of the resource state 
and measure the stabilizer operators in order to check 
whether Bob creates a correct resource state. 

KF is supported by MEXT Grant-in- Aid for Scientific 
Research on Innovative Areas 20104003. TM thanks V. 
Dunjko and E. Kashefi for valuable discussions about the 
security of blind quantum computation. 
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Appendix A 



We assume that the initial state of the computation is the standard state |0...0), and the preparation of the input 
state is included in the computational part. Therefore, what Alice wants to hide are the computation angles of the 
measurement-based quantum computation and the final output of the computation. Intuitively, a protocol is blind 
if Bob, given all the classical and quantum information during the protocol, cannot learn anything about Alice's 
computational angles and the output [3, 5, 6]. 

Definition: In this paper, we call a protocol is blind if 

(Bl) The conditional probability distribution of Alice's computational angles, given all the classical information Bob 
can obtain during the protocol, and given the measurement results of any POVMs which Bob may perform on 
his system at any stage of the protocol, is equal to the a priori probability distribution of Alice 's computational 
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angles, and 

(B2) The conditional probability distribution of the final output of Alice's algorithm, given all the classical information 
Bob can obtain during the protocol, and given the measurement results of any POVMs which Bob may perform 
on his system at any stage of the protocol, is equal to the a priori probability distribution of the final output of 
Alice's algorithm. 

m 

Theorem 1: Protocol 1 satisfies (Bl). 

Proof: Let A be the random variable which represents Ahce's measurement angles, and B be the random variable 
which represents the type of the POVM which Bob performs on his system. Let Mb be the random variable which 



represents the result of Bob's POVM. The two-party system is called no-signaling [27[ from Alice to Bob iff 

P{Mb =mB\A = a,B = b) = P{Mb ^ mB\A = a , B = b), 
for all TUB, a, a', and b. Then, 

P{Mb = mB\A = a,B = b)P{A = a, B ^ b) 
P[A = a\B = b, Mb = = — — ^ 

P[B = b, Mb = mB) 

P{Mb = mB\A = a,B ^ b)P{A = a\B = b)P{B = b) 
P(B = b,MB^mB) 

P{Mb = mB\A = a',B ^ b)P{A = a'\B = b)P{B = b) 
~ P{B = b,MB = mB) 

= P{A = a'\B = b, Mb = mB). 

This means that Bob cannot learn anything about Alice's measurement angles. I 
Theorem 2: Protocol 1 satisfies (B2). 

Proof: Let O be the random variable which represents the output of Alice's algorithm, and B be the random 
variable which represents the type of the POVM which Bob performs on his system. Let A'Ib be the random variable 
which represents the result of Bob's POVM. Alice can change the output of her algorithm by changing the input. (For 
example, since what is implemented in the quantum computation is a unitary operation, two input states which are 
orthogonal with each other become two mutually-orthogonal output states.) Because of the no-signaling principle, 

P{Mb = mB\0 ^o,B = b) = P{Mb = tubIO = o' , B = b) 

for all rn_B, o, o', and b. Then, 

P{Mb ^ uibIO = o,B = b)P{0 = o,B = b) 



P{0 = o\B = b,MB = tub) = 



P{B = b,MB = mB) 
P{Mb = niBlO = o,B = b)P{0 = o\B = b)P{B = b) 

P{B = b,MB^mB) 
P{Mb = niBlO = o',B = b)P{0 = o'\B = b)P{B = b) 

P{B = b,MB ^n-iB) 
P{0 = o'\B = 5, Mb = ms). 



Therefore, Bob cannot learn anything about the output of Alice's algorithm. 



Appendix B 

Theorem 3: Protocol 2 satisfies (Bl). 
Proof: Let us define 

A ^ (Ai,...,A^), 

$ = ($i,...,$7v), 

e = (ei,...,eAr), 

R = (i?i, i?jv), 
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where Aj,Qj,^j e A = {^\k = 0, 1, 7} and Rj € {0, 1} are random variables, corresponding to the angles sent 
by Alice to Bob, Alice's measurement angles, Alice's secret computational angles, and the hidden binary parameters, 
respectively. From the construction of the protocol 0, S| , the following relation is satisfied: 

A J = + Qj + Sj'K + RjTT (mod 27r), 

where Sj € {0, 1} is Alice's jth measurement result. Let {Ilj}"^^ be a POVM which Bob may perform on his system. 
Let O e {1, m} be the random variable corresponding to the result of the POVM. Let T be the random variable 
which represents Alice's message about the channel loss. Bob's knowledge about Alice's computational angles is given 
by the conditional probability distribution of $ = (/>jv) given O = j, T = t, and A = (Si, Sn): 

P{^ = $\0=j,A^S,T = t), 

where (j) = ^w) a-ud 6 = ((5i, (5jv). From Bayes' theorem, we have 

P(0 = j I $ = 0, A = (5, T = t)P($ = $,A = S,T = t) 



PiO = j,A^S,T = t) 
P{0 = j I $ = A = <5, T = i)P($ = $)P{A = 6,T ^t) 



= P{<^> = 



P{0 = j \ A = 5,T = t)P{A = 5,T = t) 



where 



P(<& = 



^ 1 11 1 N 

',lt ^ - J2 - TrA(p0 l^i -(t)i- s^^T - mT){Si - (p^ - sm - r^7r|) 

ri— riv— Osi— Siv— i—1 

= Tr^(p) 



and 



= ^ Y - Y ^Y -Y Y -Y TrA(p0|(5i-0i-Si7r-r,7r)((5i-</), -s,7r-n7r|) 
= TrA(p). 



4>\^A 0jvG^ ri=0 rjv=Osi=0 Siv=0 i=l 



Theorem 4: Protocol 2 satisfies (B2). 

Proof: It is easy to confirm that when Bob measures a particle, the register state is one-time padded with Z"-X^ , 
where a, /3 € {0, 1} are determined by Bob's previous measurement results. 

The values of a and /3 are unknown to Bob, since {?'j}jLi are unknown to Bob. We can show that {rj}jLi are 
unknown to Bob as follows. 

PiR^f\0=j,A^lT^t) = PiO-j\R-r,A^lT = t)PiR = r,A = S,T^t) 

P{0=j,A = S,T = t) 
P{0 = j I p = f, A = (5, r = t)P{R = r)P{A = S,T = t) 
P{0 = j \ A = S,T = t)P{A = S,T = t) 

.P(P^^^1^ 

^ ^ M^iPlt) 
= P{R^r) 

1 

2^' 
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where 

^ 1 1 N 

^ ... ^ ^ ... ^ TvAipf^ \Si - (f>i - SjTT - riTr){Si - 4>i - s^tt - nTr\ 



<f>i&A (fiN^A si=0 sjv=0 i=l 



Appendix C 

Protocol 3 runs as follows: (1) Bob prepares the Bell pair and sends the half of it to Alice. (2) If Alice does not 
receive it, she asks Bob to try again, and goes back to (1). (3) If Alice receives the particle, she does the measurement 
in the 



{^(|o>±e-^'^|i))} 

basis. How to choose 6 will be explained later. After her measurement. Bob has the state 
where |±) — :^(|0) ± a E {0, 1} is Alice's measurement result, and 

Note that RgX = e^^XR^g. (4) Bob creates the state 

CZ,,2{\iP),(g>Z-Re\+)2), 

where CZi^2 is the CZ gate between the first and the second qubits and is any Bob's state. (5) Bob performs the 
measurement in the basis {|+), |— )} on the first qubit. Since Z'^Rg commutes with CZ1.2, Bob obtains 

Z''ReX'^H\^j)2 (1) 

if the measurement result is to G {0, 1}, where H is the Hadamard gate. 
For 9 = 0, Eq. ([T]) becomes 

Z''X'''H\i})2. 

For 6 = tt/2, Eq. ^ becomes 

Z-R^^2X"'H\i:}2 = Z°X'"i?(_i)™,/2i/|V')2 

= Z''+"X™S'i/|^)2, 

where S = R.^/2- 

For = -7r/4, Eq. (P) becomes 

Z'^i?_,/4X"i7|^)2 = Z"X'"i?_(_i)™,/4i7|l^)2 

Z°'X-^TH\^)2 (to, = 0) 
Z"X"TtiJ|V')2 (to = 1), 



where T = i?_7r/4. 



8 



Note that 

{PH){PH){PH) = PH, 

{PH){PH){PSH) = PSH, 

{PH){PSH){PSH) = PHSHSH = PZS 

(PH){PH){PTH) = PTH, 

(PSH){PH){PTH) = PT^H, 

{PSH){PH){PT'^H) = PTH, 

{PH){PH){PT^H) = PT^H, 

where P is a Pauh byproduct. (Be careful that different Pauli byproducts are represented by the same character P 
for simphcity.) This means that the operations 

TH, T^H, SH,S^ 

can be done deterministically (up to Pauli byproducts) if Alice and Bob repeat the above (l)-(5) three times. Therefore, 
if we consider the unit cell (Fig. [IJ, the operations 

|/ ®I,SH® I, STH ® /, ST^H ®I,H®I, {CZ){CNOT)^ 

can be implemented deterministically up to some Pauli byproducts as is shown in Fig. [51 Note that this set is universal 
set, since 

{PSH){PH) = PS, 
{PS){PSTH){P'H) = PT, 
{PS){PST'<H){P"H) = PT, 



where P' is / or X, and P" is Z oi XZ. As is shown in Fig. [31the unit cell can be tiled to create the universal 
two-dimensional graph state which resembles the brickwork state [3| . 



o<xxy<xxf 

FIG. 1: (Color online.) The unit cell for Protocol 3. 



Appendix D 

Theorem 5: Protocol 3 satisfies (Bl). 

Proof: Let B be the random variable which represents the type of the POVM which Bob performs on his system, 
and Mb be the random variable which represents the result of the POVM. Let T be the random variable which 
represents Alice's message to Bob about the channel loss. Let A be the random variable which represents Alice's 
measurement angles. Bob's knowledge about Alice's measurement angles is given by the conditional probability 
distribution of ^ = a given B = b, Mb ~ tiib and T = t: 



P{A ^ a \ B ^b,MB ^ mB,T ^ t). 
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(a) 



II 

-A- 



(b) 



-[HlA- 



II 



(c) 



(d) 



-(HHH^I-d}^'- 
II 

— [HHlHIlA- 



-[HHIlA-t-[l]A-^ 



— d^A- 



II 



time 



(e) 



— d}^ 



II 



FIG. 2: (Color online.) Operations which can be implemented in the unit cell. Red triangles are Pauli byproducts. In (c), the 
blue T can be replaced with TK 




time 



FIG. 3: (Golor online.) Tiling for Protocol 3. 



From Bayes' theorem, we have 



P{A = a \ B = b,MB ^mB,T = t) = 



P{Mb = mB,A = a,B = b,T = t) 

P{B = b,MB = mB,T = t) 
P{Mb = mB,A = a,B^ b)P{T = t) 

P{B = b,MB = mB,T ^ t) 
P{Mb = mB I ^ = a, B = b)P{A = a,B = b)P{T = t) 

P{B = b,MB = mB,T ^ t) 
P{Mb ^niB \A = a',B = b)P{A ^a\B = b)P{T = t) 

P{B = b,MB = mB,T = t) 
P{A = a' \ B = b,MB = mB,T = t). 



Theorem 6: Protocol 3 satisfies (B2). 

Proof: Let B be the random variable which represents the type of the POVM which Bob performs on his system, 
and Mb be the random variable which represents the the result of the POVM. Let T be the random variable which 
represents Alice's message to Bob about the channel loss. Let O be the random variable which represents the output 
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of Alice's algorithm. Bob's knowledge about the output of Alice's algorithm is given by the conditional probability 
distribution of O = o given B = b, Mg = tub, and T ^ t: 

P{0 = o \ B = b,MB = mB,T = t). 

From Bayes' theorem, we have 

P{Mb = mB,0 ^ o,B = b,T = t) 



P{0 = o \ B ^b,MB = mB,T ^ t) 



P{B = b,MB = mB,T ^t) 
P{Mb ^ mB,0 = o,B ^ b)P{T = t) 

P(B = b,MB = mB,T^ t) 
P{Mb = mB \ O = o,B = b)P{0 ^o,B = b)P{T = t) 

P{B = b,MB = mB,T = t) 
P{Mb = mB \ O ^ o',B = b)P{0 = o',B^ b)P{T ^ t) 

P{B = b,MB = mB,T = t) 
P{0 = o' I B = b,MB = ruB-T ^ t). 
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